BugTraq
Stack overflow vulnerability in Internet Explorer exploitable trough VBScript and JScript scripting engines. Feb 16 2006 05:14PM
porkythepig anspi pl (1 replies)
Re: Stack overflow vulnerability in Internet Explorer exploitable trough VBScript and JScript scripting engines. Feb 18 2006 01:04PM
3APA3A (3APA3A SECURITY NNOV RU)
Dear porkythepig (at) anspi (dot) pl [email concealed],

This is a case of 'real' stack structure overflow, not stack buffer
overflow (stack overrun) as you maybe think. The process' stack is
exhausted because of recursive call. Exploitation of this situation to
execute code may be hard, if possible.

--
~/ZARAZA
http://www.security.nnov.ru/

--Thursday, February 16, 2006, 8:14:50 PM, you wrote to bugtraq (at) securityfocus (dot) com [email concealed]:

pap> It also doesn't need the call to be strictly recurrent, any infinte
pap> call-loop (even across JScript and VBScript functions) or finite
pap> but deep enough to consume all the IE thread stack memory will
pap> exploit this vulnerability as well.

pap> DoS attack as well as remote code execution are possible.

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus